where $H(.)$ is a hash2curve function (taking a value in Zn and deterministically mapping it to a curve point), and $h(.)$ is a hash function with a hash output size very close to n the order of the curve, ie $h(.)=SHA256(.) mod n$.

Towards finding a more compact ring signature I'd been trying to find a way to make c_i into a CPRNG generated sequence as they are basically arbitrary, though they must be bound to the rest of the signature (non-malleable) so that you can compute at most n-1 existential signature forgeries without knowing any private keys.

I found this paper "1-out-of-n Signatures from a Variety of Keys" by Abe, Ohkubo and Suzuki http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.363.3431&rep=rep1&type=pdf section 5.1 shows a way to do it. I show here how that is compatible with crypto note: